CVE-2026-78161: warmcat libwebsockets LECP CBOR Recording lecp.c report_raw_cbor out-of-bounds write
A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function reportrawcbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as 1d44554a1bb262db63ff4e240152a9deecd99054. It is best practice to apply a patch to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 1d44554a1bb262db63ff4e240152a9deecd99054
Event History
Frequently Asked Questions
Which deployments are affected?
The affected product version identified is warmcat libwebsockets 4.5.0, specifically the LECP CBOR Recording component in lib/misc/lecp.c. The vulnerable function is report_raw_cbor.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network attack access, low attack complexity, no privileges required, and no user interaction.
Is public exploit information available?
Yes. The exploit has been made public and could be used.
What should teams do to remediate this issue?
Apply the patch identified as 1d44554a1bb262db63ff4e240152a9deecd99054. The provided data does not describe a workaround if patching cannot be performed immediately.